Enable and Use Windows 11/10 Passkeys (Windows Hello) for Passwordless Sign-Ins
Difficulty: Intermediate |
Time Required: 15 minutes
Passkeys are a newer, safer way to sign in to websites and apps without typing passwords. Instead of something you
know (a password), you use something you
have (your device) plus something you
are/know (Windows Hello face, fingerprint, or a PIN). This dramatically reduces phishing risk, because a passkey is tied to the real site/app and can’t be “typed into” a fake login page.
Windows 11 supports passkeys most smoothly, but Windows 10 can still benefit from Windows Hello and (depending on browser/app support) may use passkeys in a more limited way. This guide walks you through enabling Windows Hello, creating passkeys where supported, and using them day-to-day.
Prerequisites
Before you start, verify the following:
- A Microsoft account or local account on the PC (either works for Windows Hello).
- Windows Hello-capable sign-in method:
- A fingerprint reader, IR camera (Windows Hello Face), or at minimum a Windows Hello PIN.
- Up-to-date Windows and browser
- Windows 11: Recommended for the best passkey experience (especially 22H2/23H2/24H2 and later).
- Windows 10: Windows Hello is supported; passkey behavior depends more on your browser and the website/app.
- Use a current version of Microsoft Edge or Google Chrome (recommended), or another passkey-capable browser.
- A website/app that supports passkeys (examples include many major identity providers, email services, and password managers—support varies).
Note (Version reality check):
Windows Hello is available on Windows 10 and 11. Passkeys (FIDO/WebAuthn “usernameless/passwordless credentials”) are primarily delivered through your browser and the website/app. Windows 11 tends to provide the most integrated, consistent passkey prompts and storage experience.
Step-by-step: Enable Windows Hello (foundation for passkeys)
Passkeys typically rely on Windows Hello to unlock them (Face/Fingerprint/PIN). Start here even if you “only” plan to use passkeys in the browser.
1) Open the Windows Hello sign-in settings
- Press Win + I to open Settings.
- Do one of the following:
- Windows 11: Go to Accounts > Sign-in options.
- Windows 10: Go to Accounts > Sign-in options.
2) Set up a Windows Hello PIN (required baseline)
- Find PIN (Windows Hello).
- Click Set up (or Add).
- Authenticate with your current password.
- Create a PIN and confirm it.
Tip: A Windows Hello PIN is device-specific and protected by the device’s security hardware (TPM) when available. It’s not the same as an online account password.
3) (Optional but recommended) Set up Face or Fingerprint
- In Sign-in options, select:
- Facial recognition (Windows Hello), or
- Fingerprint recognition (Windows Hello)
- Click Set up, then follow the on-screen steps.
Warning: If you use Windows Hello Face, make sure your camera is an IR Windows Hello camera (standard webcams usually won’t work).
4) (Optional) Require Windows Hello sign-in for your account
This helps ensure Windows prefers Hello methods.
- In Sign-in options, look for an option like “For improved security, only allow Windows Hello sign-in for Microsoft accounts on this device” (wording varies).
- Turn it On if it fits your environment.
Note: On some managed/work devices, this may be controlled by policy.
Step-by-step: Create and use passkeys on websites/apps
The exact screens vary by site, but the flow is similar everywhere: you add a passkey in the site’s security settings, then confirm with Windows Hello.
5) Update and choose your browser (recommended: Edge or Chrome)
- Open Microsoft Edge or Google Chrome.
- Update it:
- Edge updates via Settings > About Microsoft Edge.
- Chrome updates via Settings > About Chrome.
Tip: If passkey prompts don’t appear, browser updates are one of the most common fixes.
6) Create a passkey for a supported website
- Sign in to the website using your existing method (password + MFA, etc.).
- Go to the site’s Account/Security settings.
- Find Passkeys, Security keys, or Passwordless options.
- Choose Add passkey (or Create passkey).
- When Windows prompts you, choose Windows Hello.
- Verify with Face/Fingerprint/PIN.
- Give the passkey a recognizable name if asked (e.g., “My Desktop PC”).
What just happened?
Your device created a cryptographic credential tied to that specific website. The website stores a public key; your private key stays protected on your device and is unlocked by Windows Hello.
7) Sign in using the passkey (passwordless)
Next time you sign in:
- Open the website’s sign-in page.
- Select Sign in with passkey (or similar).
- Some sites show this immediately.
- Others may show it after you type your username/email.
- Approve the Windows Hello prompt (Face/Fingerprint/PIN).
- You’re signed in—no password typed.
Tip: If you don’t see a “passkey” option, look for “Use a security key” or “Other sign-in options”. Some sites hide it under secondary menus.
Step-by-step: Use passkeys across devices (and understand your storage)
Passkeys can be stored in different places depending on your setup:
- On the device (protected by Windows Hello/TPM)
- In a password manager that supports passkeys (sync across devices)
- In an account-based sync system supported by your browser ecosystem (varies)
8) Decide if you want passkey syncing
- If you want the passkey to work across your PC + phone + laptop, consider using a passkey-capable password manager (or your preferred ecosystem if it supports passkey sync).
- If you prefer “this PC only” for maximum device-bound control, keep the passkey stored locally when prompted.
Note: The availability of syncing depends on the browser and the passkey provider you choose. Windows Hello itself is primarily a local unlock mechanism; sync typically comes from a manager or cloud ecosystem.
Tips, notes, and troubleshooting
Common issues and fixes
1) “Passkey” option doesn’t appear on the website
- The site might not support passkeys yet, or only supports them in certain regions/accounts.
- Try Edge/Chrome and ensure the browser is updated.
- Check for “Other sign-in options” or “Security key” menus.
2) Windows Hello prompt appears, but fails
- Re-check Windows Hello is configured: Settings > Accounts > Sign-in options.
- Remove and re-add your PIN (last resort):
- Windows 11/10: PIN (Windows Hello) > Remove (if available) or use advanced reset options.
- Ensure your device has a functioning TPM and is not failing security checks (common on heavily modified systems).
3) You’re prompted for a password anyway
- Some sites require a password as a fallback or for “sensitive changes.”
- You may still need MFA for certain actions (financial settings, recovery, new device enrollment).
4) Passkey works in one browser but not another
- Passkeys may be stored or managed differently per browser/profile.
- Confirm you’re using the same browser profile, and check browser settings related to passwords/passkeys.
Security best practices (highly recommended)
- Keep Windows updates and browser updates current.
- Use Windows Hello Face/Fingerprint if available for convenience and strong local authentication.
- Set up account recovery options (recovery email/phone) on critical sites.
- Treat passkeys like you treat your unlocked PC session: lock your device when away (Win + L).
Warning: If someone gains access to your unlocked Windows session, they may be able to approve passkey prompts. Use a strong lock screen and consider shorter auto-lock timeouts.
Conclusion
Passkeys with Windows Hello are one of the biggest practical security upgrades for everyday users: fewer passwords to remember, fewer phishing risks, and faster sign-ins. In Windows 11, the experience is typically the most seamless, but Windows 10 users can still benefit from Windows Hello and passkeys where supported by browsers and websites. Once set up, passkey sign-ins feel like “unlock to log in”—simple, quick, and significantly more secure than typing passwords.
Key Takeaways:
- Passkeys reduce phishing risk by replacing passwords with site-bound cryptographic sign-ins.
- Windows Hello (PIN/Face/Fingerprint) is the foundation that unlocks passkeys securely.
- Windows 11 generally offers the smoothest passkey experience; Windows 10 support depends more on browser/site capabilities.
- Keep a recovery method and updated browser/OS for the best reliability and security.
This tutorial was generated to help WindowsForum.com users get the most out of their Windows experience.